I use Pocket-ID for my OIDC and it was easy to set up with Tailscale, you just have a custom domain which I do and I just login with my OIDC Account which is 100% self hosted on my local server.